What’s Real, What’s Hype, and What It Means for Your Tech Stack
Bottom line: the U.S. government tested Chinese AI models against American ones, and the results were not close. DeepSeek’s most secure model complied with 94 percent of malicious jailbreak requests. The U.S. reference models complied with 8 percent. That gap is the single most useful data point in the entire China AI debate, and it has nothing to do with geopolitics. It is a security finding, and it should change how you evaluate any AI tool before you put company data behind it.
What we’re seeing
There are two China AI stories running in parallel right now, and most coverage blends them into one. The first is the geopolitical story: is China stealing American AI models to build its own? The second, and the one that matters to your business, is the security story: does it matter, practically, which country’s model sits behind the tool your team uses every day?
On the first question, the honest answer is yes, and it is more complicated than either side wants it to be. In September 2026, the NSA, FBI, and CISA jointly named six Chinese AI firms for running large-scale campaigns to train their own models on the outputs of American frontier systems, a practice called distillation. The advisory was careful to say distillation itself is not the violation. It is a legitimate, widely used technique. The violation, in the agencies’ assessment, was the scale and the use of proxy accounts to evade detection.
China’s government rejected the characterization, calling distillation “a neutral technique practiced by companies in both countries.” That is true as a general statement and beside the point as a response to the specific allegation. Security researchers have also raised a fair technical criticism: the advisory’s own recommended detection signals, like sustained heavy usage from new accounts, look a lot like an ordinary enterprise deployment. That is a legitimate caveat, and it should temper confidence in any single enforcement action built on those signals alone.
Here is where I’d push back on the more alarmist framing, though. The idea that Chinese AI companies are permanently stuck copying and can never out-innovate what they distilled does not hold up against the historical record. Japan’s electronics industry, South Korea’s semiconductor industry, China’s own solar and EV sectors, all followed the identical arc: import or copy first, then out-innovate the original within a decade or two. DeepSeek’s own R1 model was a genuine architectural advance that Western labs studied and adapted, not a copy of anything. Betting that China stays permanently behind on capability is not a safe bet. It has not been true of any other industry, and there is no clear reason AI is the exception.
Where this gets concrete for you
Set aside the capability race for a moment. The part of this that should actually change your vendor decisions is narrower, better evidenced, and comes from the U.S. government’s own technical testing, not from advocacy research or intelligence assessments.
NIST’s Center for AI Standards and Innovation ran DeepSeek’s models against four U.S. reference models across nineteen benchmarks. The jailbreak-compliance gap, 94 percent versus 8 percent, is the headline number, but it is not the only one. Agents built on the DeepSeek model were roughly twelve times more likely than the U.S. models tested to follow malicious hijacking instructions in a simulated environment: sending phishing email, fetching malware, exfiltrating credentials. On politically sensitive questions, the model echoed inaccurate or misleading state narratives roughly four times as often as U.S. models, a rate that rose further in Chinese-language testing. A follow-on test in December 2025 found the same pattern held for Alibaba’s Qwen and Moonshot’s Kimi, so this is not one company’s anomaly. It is a pattern across the ecosystem.
I want to be precise about what that does and does not prove. It does not prove there is a hidden backdoor engineered into these models. That fear gets raised often, and it has never been established with solid evidence. What it does prove is that these models are measurably, substantially less resistant to being turned into a tool for harm, whether that’s an attacker manipulating the model directly or the model’s own guardrails simply not holding up under pressure the way U.S. models’ guardrails do.
There is also a legal dimension that has nothing to do with model quality at all. Under Chinese intelligence law, authorities can compel access to data held by China-based commercial entities. A prompt you send to a China-hosted model API, including whatever proprietary business data rides along with it, sits under a materially different legal regime than the same prompt sent to a U.S.-hosted commercial model or a model you run yourself on infrastructure you control.
What this means for your tech stack
In short, you do not need to resolve the broader U.S.-China AI competition to make a good decision here. That fight will keep playing out in Washington and Beijing regardless of what your business does. What you can control, starting now, is where your data goes and under what legal regime it sits once it gets there.
That means asking, for every AI tool your business relies on: which model is behind this, where does inference run, where are logs stored, and what government can compel access to that data if it ever wants to? Those are not abstract policy questions. They are the same due diligence you would already apply to any vendor handling sensitive business information, just applied to a category of tool that is often adopted faster than it is vetted.
This is exactly the kind of decision that gets made once, in a hurry, during a product rollout, and then never revisited. It shouldn’t be. The full whitepaper this series is drawn from, “The Superintelligence Reckoning,” goes deeper into the distillation advisory, the historical case for why China is unlikely to stay behind on capability long-term, and a fuller vendor-evaluation framework for exactly this kind of decision. But if this is a live question for your business right now, do not wait for perfect certainty. Start with our AI Reality Check, a free, 30-minute conversation about your environment and your use cases for AI. We can help you identify which AI tools are already in use, where your data is going, which vendors create real exposure, and what practical steps to take next. Net: you do not need an abstract AI strategy first. You need to know whether the tools already touching your business are safe, aligned, and worth the risk.